HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 11, 2015.
- Organization as reported
- Northwest Primary Care Group, OR
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Desktop Computer, Paper/Films
- Submission date
- Dec. 11, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14652, row:5791)
- Archived copy
- Held in the private archive (provenance)
On October 13, 2015, the covered entity (CE), Northwest Primary Care Group, discovered that a former employee, prior to being terminated, had impermissibly accessed and downloaded information from a desktop computer within the facility. Local law enforcement notified the CE that the former employee had accessed and printed a fifty-two (52) page document that contained the protected health information of 5,327 individuals. The types of PHI contained in the document included the names of 5,327 patients, and one or more of the following: social security numbers, dates of birth, credit card and/or bank account information. The CE notified HHS, affected individuals, and the media pursuant to the Breach Notification Rule. It also offered one year of free credit monitoring to all affected individuals. Following the breach, the CE implemented technical safeguards, revised its HIPAA policies and procedures, and retrained workforce members. OCR obtained satisfactory assurances that the CE implemented the corrective actions noted above.